Spotify Privacy Policy changes — 20240401_rev01

660

After your account is deleted, we keep some data for a longer time period but for very limited purposes. For example, we may be subject to legal or contractual obligations that require this. These may include mandatory data retention laws, government orders to preserve data relevant to an investigation, or data kept for the purposes of litigation. We may also keep data that has been removed from the Spotify Service for a limited period of time. This could be:

661

- to help ensure user safety, or

662

- to protect against harmful content on our platform.

663

664

This helps us investigate potential breaches of our [User Guidelines](https://www.spotify.com/legal/user-guidelines/) and [Platform Rules](https://www.spotify.com/platform-rules/). On the other hand, we will remove unlawful content if the law requires us to do so.

665

666

## [**7\. Transfer to other countries**]()

666

## [7\. Transfer to other countries]()

667

668

Because of the global nature of our business, Spotify transfers personal data internationally with Spotify group companies, subcontractors and partners when carrying out the activities described in this Policy.

669

670

Whenever we transfer personal data internationally, we use tools to make sure the data transfer complies with applicable law.

671

672

We also identify and use additional protections as appropriate for each data transfer. For example, we use:

673

674

- technical protections, such as encryption and pseudonymization

675

- policies and processes to challenge disproportionate or unlawful government authority requests

676

677

## [**8\. Keeping your personal data safe**]()

677

## [8\. Keeping your personal data safe]()

678

679

We're committed to protecting our users' personal data. We put in place appropriate technical and organizational measures to help protect the security of your personal data. However, be aware that no system is ever completely secure.

680

681

We have put various safeguards in place to guard against unauthorized access and unnecessary retention of personal data in our systems. These include pseudonymization, encryption, access, and retention policies.

682

683

To protect your user account, we encourage you to:

19	19	[9\. Children]()
20	20
21	21	[10\. Changes to this Policy]()
22	22
23	23	[11\. How to contact us]()
24	24
25		## [1\. About this Policy]()
	25	## [1\. About this Policy]()
26	26
27	27	This Privacy Policy describes how we process your personal data at Spotify USA Inc. From now on, we'll call it the 'Policy'.
28	28
29	29	It applies to your use of:
30	30
31	31	- all Spotify streaming services as a user. For example this includes:
58	58	- choose whether to show your recently played artists on your public profile
59	59
60	60	On the 'Explicit Content' setting you can control whether explicit-rated content can be played on your Spotify account.
61	61
62	62	- [Cookies Policy](https://www.spotify.com/legal/cookies-policy/): Information on how we use cookies and how to manage your cookie preferences. Cookies are files saved on your phone, tablet or computer when you visit a website.
63	63
64		## [2\. Your personal data rights and controls]()
	64	## [2\. Your personal data rights and controls]()
65	65
66	66	Privacy laws give certain rights to individuals over their personal data.
67	67
68	68	The table below explains:
69	69
70	70	- your rights
114	114
115	115	- adjust the relevant control on Spotify
116	116	- [contact us]()
117	117
118	118	\|
119	119
120		#### [Verifying requests, generally]()
	120	#### [Verifying requests, generally]()
121	121
122	122	To verify a consumer request to know, request to delete, and request to correct, we ask you to provide certain details related to your Spotify account. Please note, if you do not have a Spotify account we will not have enough information about you to verify your identity and respond to your requests, as we do not keep sufficient information necessary to re-identify and link you to a prior visit to the Spotify Service where data may have been collected. As such, we will be unable to verify and honor your requests.
123	123
124		#### [Household requests]()
	124	#### [Household requests]()
125	125
126	126	If all the members of a household make an access, correction or deletion request, we will respond as if the requests are individual requests.
127	127
128		#### [Tailored advertising controls]()
	128	#### [Tailored advertising controls]()
129	129
130	130	What is tailored advertising?
131	131
132	132	- This is when we use information about your use of our Services and other websites and mobile apps to tailor ads to be more relevant to you. This is also known as interest based advertising, targeted advertising, or 'sharing' for purposes of cross-context behavioral advertising.
133	133	- An example of tailored advertising is when an advertising partner has information suggesting you like cars. This could enable us to show you ads about cars.
134	134
143	143	Appropriate age for tailored advertising:
144	144
145	145	- The appropriate age for tailored advertising is determined by the country you are in and what rules apply to tailored advertising in that country. You will not receive Tailored Ads unless you have reached the appropriate age.
146	146	- You will not be able to 'opt-in' to Tailored Ads if you are under the appropriate age.
147	147	- You will start to receive Tailored Ads once you reach the appropriate age for your country. When this happens, you will receive a message within the Spotify Service to let you know. This message will contain a link to the [Privacy Settings](https://www.spotify.com/account/privacy/) where you can change your preferences or 'opt-out' of Tailored Ads at any time.
148	148
149		## [3\. Personal data we collect about you]()
	149	## [3\. Personal data we collect about you]()
150	150
151	151	These tables set out the categories of personal data we collect from you. You can also watch our video about [Personal Data at Spotify](https://www.spotify.com/privacy).
152	152
153	153	\| Collected when you sign up for the Spotify Service or when you update your account \|
154	154	\| --- \|
155	155	\| Categories \| Description \|
286	286	\| Advertising and marketing partners \| We receive inferences from certain advertising or marketing partners. These inferences are the partners' understanding of your interests and preferences.
287	287	This allows us to deliver more relevant ads and marketing. \| Usage Data \|
288	288	\| Acquired companies \| We may receive data about you from companies we acquire. This is to enhance our services, products, and offerings. \| User DataUsage Data \|
289	289
290	290	If you download the Spotify mobile app and try Spotify using a logged out user experience, we will collect limited information about your usage of the Spotify Service, including Usage Data. We do this to understand how you are accessing and using the Service. We also do this to ensure we provide the right experience for you, for example based on your country or region. If you decide to create a Spotify account to experience our service in full, then we will combine this data with your Spotify account data.
291	291
292		## [4\. Our purpose for using your personal data]()
	292	## [4\. Our purpose for using your personal data]()
293	293
294	294	The table below sets out:
295	295
296	296	- our purpose for processing your personal data
297	297	- categories of personal data which we use for each purpose. See more about these categories in [Section 3 'Personal data we collect about you']()
298	298
448	448	- User Data
449	449	- Usage Data
450	450	- Survey and Research Data
451	451
452	452	\|
453	453
454		## [5\. Disclosing your personal data]()
	454	## [5\. Disclosing your personal data]()
455	455
456	456	This section sets out who receives personal data which is collected or generated through your use of the Spotify Service.
457	457
458	458	Publicly available information
459	459
460	460	The following personal data will always be publicly available on the Spotify Service (except to any user you have blocked):
635	635	- Payment and Purchase Data
636	636	- Survey and Research Data
637	637
638	638	\| If we were to sell or negotiate to sell our business to a buyer or possible buyer.
639	639	In this case, we may transfer your personal data to a successor or affiliate as part of that transaction. \|
640	640
641		## [6\. Data retention]()
	641	## [6\. Data retention]()
642	642
643	643	We keep your personal data only as long as necessary to provide you with the Spotify Service and for Spotify's legitimate and essential business purposes, such as:
644	644
645	645	- maintaining the performance of the Spotify Service
646	646	- making data-driven business decisions about new features and offerings
647	647	- complying with our legal obligations
660	660	After your account is deleted, we keep some data for a longer time period but for very limited purposes. For example, we may be subject to legal or contractual obligations that require this. These may include mandatory data retention laws, government orders to preserve data relevant to an investigation, or data kept for the purposes of litigation. We may also keep data that has been removed from the Spotify Service for a limited period of time. This could be:
661	661	- to help ensure user safety, or
662	662	- to protect against harmful content on our platform.
663	663
664	664	This helps us investigate potential breaches of our [User Guidelines](https://www.spotify.com/legal/user-guidelines/) and [Platform Rules](https://www.spotify.com/platform-rules/). On the other hand, we will remove unlawful content if the law requires us to do so.
665	665
666		## [7\. Transfer to other countries]()
	666	## [7\. Transfer to other countries]()
667	667
668	668	Because of the global nature of our business, Spotify transfers personal data internationally with Spotify group companies, subcontractors and partners when carrying out the activities described in this Policy.
669	669
670	670	Whenever we transfer personal data internationally, we use tools to make sure the data transfer complies with applicable law.
671	671
672	672	We also identify and use additional protections as appropriate for each data transfer. For example, we use:
673	673
674	674	- technical protections, such as encryption and pseudonymization
675	675	- policies and processes to challenge disproportionate or unlawful government authority requests
676	676
677		## [8\. Keeping your personal data safe]()
	677	## [8\. Keeping your personal data safe]()
678	678
679	679	We're committed to protecting our users' personal data. We put in place appropriate technical and organizational measures to help protect the security of your personal data. However, be aware that no system is ever completely secure.
680	680
681	681	We have put various safeguards in place to guard against unauthorized access and unnecessary retention of personal data in our systems. These include pseudonymization, encryption, access, and retention policies.
682	682
683	683	To protect your user account, we encourage you to:
691	691	You can log out of Spotify in multiple places at once by using the 'Sign out everywhere' function on [your account page](http://www.spotify.com/account).
692	692
693	693	If other individuals have access to your Spotify account, then they can access personal data, controls and the Spotify Service available in your account. For example, you might have allowed someone to use your account on a shared device.
694	694
695	695	It's your responsibility to only allow individuals to use your account where you're comfortable sharing this personal data with them. Anyone else's use of your Spotify account may impact your personalized recommendations and be included in your data download.
696	696
697		## [9\. Children]()
	697	## [9\. Children]()
698	698
699	699	Note: This Policy doesn't apply to Spotify Kids unless the [Spotify Kids Privacy Policy](https://www.spotify.com/legal/kids-privacy-policy/) says so. Spotify Kids is a separate Spotify application.
700	700
701	701	The Spotify Service has a minimum 'Age Limit' in each country or region. The Spotify Service is not directed to children whose age:
702	702
703	703	- is under the age of 13 years
709	709	If you're a parent of a child under the Age Limit and become aware that your child has provided personal data to Spotify, [contact us]().
710	710
711	711	If we learn that we've collected the personal data of a child under the applicable Age Limit, we'll take reasonable steps to delete the personal data. This may require us to delete the Spotify account for that child.
712	712
713	713	When using a shared device on the main Spotify Service, be cautious about playing or recommending any inappropriate content to individuals under 18 years old.
714	714
715		## [10\. Changes to this Policy]()
	715	## [10\. Changes to this Policy]()
716	716
717	717	We may occasionally make changes to this Policy.
718	718
719	719	When we make material changes to this Policy, we'll provide you with prominent notice as appropriate under the circumstances. For example, we may display a prominent notice within the Spotify Service or send you an email or device notification.
720	720
721		## [11\. How to contact us]()
	721	## [11\. How to contact us]()
722	722
723	723	For any questions or concerns about this Policy, contact our Data Protection Officer any one of these ways:
724	724
725	725	- email [privacy@spotify.com](mailto:privacy@spotify.com)
726	726	- write to us at: Spotify USA Inc., 150 Greenwich Street, Floor 62, New York, NY 10007, USA
727	727

Privacy Policy

Full text changes — 20240201_rev01 to 20240401_rev01